Quantstamp reviewed Sequence on 12 Jan 2024: 23 findings, 0 critical; 15 marked fixed, 7 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 1 | 7 | 13 |
It is crucial to validate inputs, even if they come from trusted addresses, to avoid human error. A lack of robust input validation can only increase the likelihood and impact in the event of mistakes. Following is the list of places that can potentially benefit from stricter input validation: 1. qs-badge-acknowledged `ERC721Sale.sol`: the `cost` of the `setSaleDetails()` should not be zero. 2. qs-badge-fixed `ERC721Sale.sol`: the `endTime` of the `setSaleDetails()` should not be zero. 3. qs-badge-fixed `ERC721Sale.sol`: `setSaleDetails()` should validate that `startTime` is less than `endTime`. 4. qs-badge-acknowledged `ERC1155Sale.sol`: validate that `tokenIds` and `amounts` have the same length in `mint()`. 5. qs-badge-acknowledged `ERC20BaseToken.sol`: the `amount` of the `burn()` should not be zero. It is possible to burn zero amount of ERC-20 tokens with the current implementation. 6. qs-badge-acknowledged `ERC20Items.sol`: the `amount` of the `mint()` should not be zero. It is possible to mint zero ERC-20 tokens with the current implementation. 7. qs-badge-fixed `Orderbook._createOrder()` should validate that `request.tokenContract` and `request.currency` are not the zero address. 8. qs-badge-fixed `Orderbook.isOrderValidBatch()` should validate that `orderIds` and `quantities` are of equal length. 9. qs-badge-acknowledged `Trust.constructor()` should validate that `owner` and `beneficiary` are not set to the zero address.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us